Reduction of false alarms in PDCCH detections

ABSTRACT

Methods and systems for determining scheduling information of a base station in a network operating according to the Long Term Evolution (“LTE”) standard include monitoring transmissions on the PDCCH of the wireless base station, maintaining a list of active Radio Network Temporary Identifiers (“RNTI&#39;s”) assigned by the wireless base station to user equipment, extracting PDCCH detections from the monitored transmissions, applying at least one false alarm reduction strategy to eliminate invalid PDCCH detections from the extracted PDCCH detections, said false alarm reduction strategy including determining an RNTI that is valid for an extracted PDCCH detection and determining if the valid RNTI is included in the list of active RNTI&#39;s. Scheduling information of the wireless base station is determined from the extracted PDCCH detection.

BACKGROUND

With reference to FIG. 1, cellular networks typically include aplurality of adjacent cells 100, each of which is managed by acentralized scheduling and communication device 102, commonly referredto as a base station (“BS”), which communicates with subscribers 104,106 that are located within the cell 100 and connected to the BS 102.The subscribers 104, 106 are commonly referred to as user equipment(“UE”).

With reference to FIG. 2A, communication between the BS 102 and the UE's104, 106 is tightly controlled by the BS 102. According to the Long TermEvolution (“LTE”) protocol, messages are exchanged between the basestation 102 and the UE's 104 through a plurality of “physical channels”202, 204, 206, 210, 212. In particular, the base station 102 transmitsboth downlink scheduling and uplink scheduling to the UE's 104, 106through the Physical Downlink Control CHannel (“PDCCH”) 212. Thedownlink scheduling information contains the information for the UE 104to understand and decode messages from the base station, while theuplink scheduling information contains the information that is used bythe UE 104 to transmit its own messages to the base station.

If the base station transmits downlink information to a UE, it transmitsdownlink scheduling information on the PDCCH 212 and sends the actualdownlink information on the PDSCH 206. If a UE 104 wishes to send uplinkinformation to the BS 102, it first sends a request for authorization tothe BS 102 through the Physical Uplink Control CHannel (“PUCCH”) 210,and the BS 102 responds with an uplink scheduling grant through thePDCCH 212. The data is then sent to the base station in the PUSCH 204using parameters specified by the scheduling grant information.

Of course, this means that all of the active UE's 104, 106 in the cell100 must monitor the PDCCH 212 at all times. With reference to FIG. 2B,a PDCCH transmission 218 will generally contain PDCCH messages for aplurality of UE's. The BS multiplexes the PDCCH messages for the variousUEs across the available bandwidth as shown in FIG. 2B. The smallestrelevant section of the bandwidth is known as a Control Channel Elements(CCE) 216. Each CCE 216 consists of 36 subcarriers. A single PDCCHmessage can include 1, 2, 4 or 8 CCEs 216 to account for differentamounts of information included in the messages. PDCCH messages cannotoverlap in frequency, but must be multiplexed in frequency as shown inFIG. 2B.

Each UE must therefore consider a plurality of different combinations ofCCE's 216 in each PDCCH transmission 218 to determine if it is theintended recipient for any of the messages. As illustrated in FIG. 2C,this search is made easier by the fact that the RNTI defines a limitedsearch space for each UE, so that the UE need not perform an exhaustivesearch over all potential combinations of CCE's 216 in the transmission.

Each UE must also search across various Downlink Control Information(“DCI”) formats, which correspond to different packet lengths, messagetypes, and structures that are typically related to the number ofantennas and the MIMO type supported by the terminal. For downlinkspecific DCI formats, the downlink transmission mode (“TM”) dictates theDCI formats that the UE must check.

To ensure that each PDCCH scheduling message is accepted only by theintended recipient UE or recipient UE's, the BS 102 assigns a uniqueRadio Network Temporary Identifier (“RNTI”) to each active UE 104, 106in the cell, and then scrambles the cyclic redundancy check (CRC) foreach PDCCH message using the RNTI that has been assigned to the intendedrecipient. The UE 104 then monitors the PDCCH and performs adescrambling operation on the CRC using its RNTI. If the CRC passes theUE knows that the scheduled information is intended for it.

Note that the LTE standard defines several types of RNTI, including notonly RNTI's that are assigned uniquely to individual UE's (e.g.RA-RNTI's and C-RNTI's), but also RNTI's that are assigned to groups ofUE's (e.g. P-RNTI's), or even to all the UE's in the cell (e.g.SI-RNTI's). For simplicity, unless otherwise specified, the invention isdescribed herein with reference to RNTI's that are uniquely assigned toUE's, but it should be noted that the invention can be applied to manyor all types of RNTI, and that the term “RNTI” is used hereingenerically to refer to all such types of RNTI.

At any given time there may be many UE's in the cell that are idle.Accordingly, the BS 102 assigns RNTI's to the UE's as they transitionfrom the idle state to the active state through a process called“acquisition.” When a UE transitions back to an idle state, the assignedRNTI is released, and may subsequently be assigned to a different UE inthe cell 100.

During acquisition 200 an idle UE initiates the acquisition process bysending an authorization request through the “Physical Random AccessCHannel (“PRACH”) 202. The BS 102 responds by assigning an RNTI to theUE 104. The acquisition process then proceeds through an exchange ofmessages that are transmitted by the UE on the Physical UplinkScheduling CHannel (“PUSCH”) 204 and by the BS on the Physical DownlinkScheduling CHannel (“PDSCH”) 206.

FIG. 3A presents a somewhat more detailed illustration of the LTEacquisition handshake process in terms of seven “events” that areincluded in the handshake.

For each possible combination of CCE's in a PDCCH transmission, referredto herein as PDCCH “detections,” there will be a corresponding “valid”RNTI. This applies both to actual “correct” messages and to “incorrect”detections that do not represent actual messages. This effect occurs dueto the PDCCH CRC being 16 bits, as well as there being 2^16 valid RNTIs,making one RNTI appear to be valid for every possible combination ofCCEs. Since only a small subset of the total RNTI's will typically beallocated to UE's, herein referred to as the “active” RNTIs, most ofthese valid RNTI's will not correspond with any of the RNTI's that havebeen assigned by the BS to active UE's in the cell. However, it cansometimes happen by chance that a certain combination of CCE's in aPDCCH transmission corresponds with a valid RNTI that has in fact beenassigned to an active UE, even though the combination of CCE's is not anactual message. This can cause the UE to falsely attempt to transmit orreceiver a message, depending on the contents of the falsely decodedPDCCH message.

It may be desirable under some circumstances to use a device such as a“PDCCH sniffer,” to obtain complete scheduling knowledge for a cell bydecoding all of the PDCCH messages transmitted by the BS 102. Such adevice can be useful for drive testing, network monitoring, and/ordebugging, for a network that is either in a lab or fielded. A PDCCHsniffer can also be useful as a parameter receiver which monitors nearbycells in order in improve their performance and/or the performance ofsome aspect of the network. A parameter receiver may be integrated intoa UE or a base station.

The PDCCH sniffer may perform an exhaustive search over all possiblecombinations of CCE's in each PDCCH transmission. In general, this willresult in many PDCCH “false alarms,” where the sniffer has falselydetected that a certain PDCCH detection is destined for a UE with acertain RNTI. The false alarm rate will be very high, because eachcombination of CCE's that is searched will have a valid RNTI that is oneof the possible RNTI's, regardless of whether the detection is actuallya message. Since the false alarm rate will be so high, the informationobtained by the sniffer cannot be relied upon as accurate.

This false alarm problem becomes worse as multiple DCI formats areconsidered with different packet lengths. The different DCI formats usedifferent message structures and lengths, each format being intended fora different purpose. These multiple formats exacerbate the problem offalse alarms, because a sniffer device attempting to obtain completescheduling knowledge must search each combination of CCI's for each DCIformat, unless the sniffer knows the transmission mode of the BS and canthereby narrow the search.

What is needed, therefore, is a method for reducing PDCCH false alarmsduring analysis of PDCCH transmissions by a sniffer device.

SUMMARY

Accordingly, a method and system are described for reducing PDCCH falsealarms during analysis of a PDCCH transmission. The method includesdetermining and maintaining a list of active RNTI's in the cell,extracting PDCCH detections from the transmission, and comparing thevalid RNTI for an extracted PDCCH detection with the active RNTI's onthe list.

According to an exemplary embodiment, a method is described ofdetermining scheduling information of a base station in a networkoperating according to the Long Term Evolution (“LTE”) standard. Themethod includes monitoring transmissions on the Physical DownlinkControl CHannel (“PDCCH”) of the wireless base station, maintaining alist of active Radio Network Temporary Identifiers (“RNTI's”) assignedby the wireless base station to user equipment, extracting PDCCHdetections from the monitored transmissions, applying at least one falsealarm reduction strategy to eliminate invalid PDCCH detections from theextracted PDCCH detections, said false alarm reduction strategyincluding determining an RNTI that is valid for an extracted PDCCHdetection, and determining if the valid RNTI is included in the list ofactive RNTI's, and determining scheduling information of the wirelessbase station from the extracted PDCCH detections.

According to another exemplary embodiment, a system is described fordetermining scheduling information of a base station in a networkoperating according to the Long Term Evolution (“LTE”) standard. Thesystem includes a sniffing device configured for receiving PDCCHtransmissions from a wireless base station in a network operatingaccording to the Long Term Evolution (“LTE”) standard, and a controllercoupled to the sniffing device. The controller is configured to monitortransmissions on the Physical Downlink Control CHannel (“PDCCH”) of thewireless base station, maintain a list of active Radio Network TemporaryIdentifiers (“RNTI's”) assigned by the wireless base station to userequipment, extract PDCCH detections from the monitored transmissions,apply at least one false alarm reduction strategy to eliminate invalidPDCCH detections from the extracted PDCCH detections, said false alarmreduction strategy including determining an RNTI that is valid for anextracted PDCCH detection, and determining if the valid RNTI is includedin the list of active RNTI's, and determine scheduling information ofthe wireless base station from the extracted PDCCH detections.

According to yet another exemplary embodiment, a non-transitorycomputer-readable medium storing a computer program is described, thecomputer program being executable by a machine for operating a sniffingdevice configured for receiving PDCCH transmissions from a wireless basestation in a network operating according to the Long Term Evolution(“LTE”) standard. The computer program includes executable instructionsfor, monitoring transmissions on the Physical Downlink Control CHannel(“PDCCH”) of the wireless base station, maintaining a list of activeRadio Network Temporary Identifiers (“RNTI's”) assigned by the wirelessbase station to user equipment, extracting PDCCH detections from themonitored transmissions, applying at least one false alarm reductionstrategy to eliminate invalid PDCCH detections from the extracted PDCCHdetections, said false alarm reduction strategy including determining anRNTI that is valid for an extracted PDCCH detection, and determining ifthe valid RNTI is included in the list of active RNTI's, and determiningscheduling information of the wireless base station from the extractedPDCCH detections.

The features and advantages described herein are not all-inclusive and,in particular, many additional features and advantages will be apparentto one of ordinary skill in the art in view of the drawings,specification, and claims. Moreover, it should be noted that thelanguage used in the specification has been principally selected forreadability and instructional purposes, and not to limit the scope ofthe inventive subject matter.

BRIEF DESCRIPTION OF THE DRAWINGS

The accompanying drawings provide visual representations which will beused to more fully describe the representative embodiments disclosedhere and can be used by those skilled in the art to better understandthem and their inherent advantages. In these drawings, like referencenumerals identify corresponding elements, and:

FIG. 1 is a simplified diagram showing a communication cell of the priorart;

FIG. 2A is a block diagram illustrating physical channels used forcommunication between a UE and the base station during acquisition andduring data exchange;

FIG. 2B illustrates the use of different numbers of CCE's in PDCCHtransmissions, and the multiplexing thereof according to the prior art;

FIG. 2C illustrates the assignment by the BS of UE-specific searchspaces for the PDCCH transmissions, in addition to “common” searchspaces;

FIG. 3 is a block diagram illustrating the LTE acquisition handshakeprocess in detail;

FIG. 4 is a flow diagram illustrating an exemplary embodiment; and

FIG. 5 is a simplified perspective view of a PDCCH sniffing device.

DETAILED DESCRIPTION

A method and system are described for reducing PDCCH false alarms duringanalysis of a PDCCH transmission. With reference to FIG. 4, the methodincludes acquiring a PDCCH transmission 400, determining and maintaininga list of active RNTI's in the cell 402, extracting PDCCH detectionsfrom the transmission 404, determining the valid RNTI's for theextracted detections 406, applying at least one false alarm reductionstrategy to eliminate invalid PDCCH detections from the extracted PDCCHdetections, said false alarm reduction strategy including determining ifat least one of the valid RNTI's is included in the list of activeRNTI's 408, 410, and determining scheduling information for the cellfrom the PDCCH detections that are not false alarms 412.

The only UEs that will have active RNTIs will be the ones that are inthe RRC_CONNECTED state, because they are about to, or have recently,transmitted or received data. It is a core LTE assumption that a cellwill only assign a small fraction of the available RNTI's, so that acell operating according to the LTE protocol has a reasonable falsealarm rate. If all 65536 RNTI's were actually assigned to active UE's ina cell, the number of the false alarms of the UEs would equal that of aPDCCH sniffer performing an exhaustive PDCCH search without any falsealarm reduction. Similarly, if a PDCCH sniffer were to perform a PDCCHsearch and retain only those detections for which the valid RNTI wasamong the subset of RNTIs assigned to the RRC_CONNECTED devices, thenthe search would include the same number of false alarms as the totalnumber of UE false alarms, which can be assumed to be within areasonable range.

Therefore, maintaining an accurate and updated list of RNTI's assignedto active UE's, herein referred to as “active” RNTI's, can provide apowerful mechanism for reducing the PDCCH false alarms to an acceptablelevel. Note that the active RNTI list does not need to be completelyaccurate to achieve an acceptable PDCCH false alarm rate.

Embodiments follow any of at least three approaches for enabling a PDCCHsniffer to establish and maintain an accurate list of RNTI's. Oneapproach is information sharing, whereby the list of active RNTI's isdirectly provided to the sniffer, either through a back channel ordirectly over the LTE link by another node in the network, such as abase station, a controller in the network, or some other node that hasbetter monitoring capability than the PDCCH sniffer.

Another approach for enabling a PDCCH sniffer to establish and maintainan accurate list of active RNTI's is for the sniffer to monitor theexchanges of acquisition messages that control the transitioning of UE'sfrom an idle state to a connected state. During acquisition, the basestation and UE execute an extensive handshake procedure, illustrated inFIG. 3, during which the base station assigns at least one RNTI to theUE. An acquisition occurs whenever a user transitions from the RRC_IDLEstate to the RRC_CONNECTED state, either because the UE wants totransmit information, or because there is data to be received throughthe network. This acquisition handshake procedure provides multipleopportunities for a sniffer to determine the active RNTI for the newlyacquired UE, so that it can add the new active RNTI to the list ofactive RNTI's.

One challenge in some cases is when only the uplink or only downlinkchannels can be monitored during acquisition, thereby requiring thatsome information be inferred regarding the channels that are notmonitored.

With reference to FIG. 3, opportunities for acquisition monitoring areprovided for example by Event 4 of the acquisition handshake process,which is transmitted with a random access RNTI (“RA-RNTI”) and containsinstructions for the UE that include the temporary RNTI (TC-RNTI) forthe UE, which becomes the more permanent RNTI (C-RNTI) as long as thereare no issues in the rest of the process. The acquisition handshakeprocess will include many additional messages using the PUSCH and PDSCHchannels in a short period of time as the TC-RNTI is transitioned to themore permanent C-RNTI. This means that a detected TC-RNTI is reasonablylikely to be real if it is utilized often during the acquisitionhandshake. Additionally, it can be assumed that the frequently usedTC-RNTI detected within the handshake messages will soon be an activeC-RNTI, and so should be added to the list of active RNTI's.

Still another approach for enabling a PDCCH sniffer to establish andmaintain an accurate list of active RNTI's and/or to detect PDCCH falsealarms is pattern detection, whereby patterns of the PDCCH detectionsare monitored and utilized to identify correct detections.

Approaches to pattern detection used in various embodiments are referredto herein as “PDSCH verification,” “PDCCH info,” “PDCCH patterns,”“PDCCH RNTI occurrences,” “RNTI allocation strategies,” and “RRCcontent.” These approaches are described below.

PDSCH verification: According to this approach, embodiments useinformation derived from the Physical Downlink Shared Channel (PDSCH) toverify whether a PDCCH detection is correct or not. For example, when aPDCCH transmission contains a downlink scheduling message, acorresponding PDSCH packet occurs in the same subframe, and decodingmetrics of this PDSCH packet can be used to verify the correctness ofthe corresponding PDCCH detection, where the term “decoding metrics”refers to any information that can be derived from receiver signalprocessing that gives an indication as to whether the schedulingparameters from the PDCCH are correct. Another possibility is toidentify the active resource blocks for the PDSCH messages throughenergy detection or similar method, and determine individual PDCCHdetections or combinations of PDCCH detections that are valid for theactive resource blocks.

Once a PDCCH detection is determined to be correct, the correspondingvalid RNTI can then be compared with the list of active RNTI's, andadded to that list if it is not already there. Note that since the RNTIis an identifier for the UE, the same RNTI is used for both uplink anddownlink scheduling. As an example,

PDCCH info: According to this approach, embodiments detect false alarmsbased on information contained within the PDCCH detections themselves.For example, it may be known that some DCI formats and/or features arenot allowed, due to a network restriction and/or to a requirement of theLTE release that has been implemented. For example some base stationsmay not support DCI format 1C, format 3, and format 3A. Accordingly, theapparent use of an excluded DCI format in a PDCCH detection can indicatea false alarm. Other information in the PDCCH detection that may besufficient to detect a false alarm includes an apparent use of amodulation and coding option that is invalid, and/or the apparentpresence of frequency hopping for a network that is known not to usefrequency hopping.

In this regard, it can be helpful to know the transmission mode that isbeing used by the UE, as determined during acquisition of the UE by thebase station. If the TM mode of a UE is known, then it is also knownwhich DCI formats are allowed for that UE, since each DCI format can beused only for some specific TM's. For example, DCI format 1 can be usedonly for a TM of 1, 2, or 7, and DCI format 2A can be used only for a TMof 3. In contrast, DCI format 1A can be used for all nine TM's.

PDCCH patterns: According to this approach, embodiments detect falsealarms by comparing PDCCH detections with each other, and detectingpatterns of content change. For example, if the MCS_Index appears tochange drastically from one detection to the next detection, this couldindicate a false alarm. Apparent use of different DCI formats can alsoprovide a pattern for detecting false alarms. Even if the TM of a UE isnot known, it is still often possible to narrow the range of possibleTM's for a given UE, and therefore a given active RNTI, according to thepattern of DCI formats for that RNTI that are found in the PDCCHdetections. Then, in embodiments, if a PDCCH detection makes it appearas if a UE has suddenly changed its DCI format in a way that is notpossible for any of the TM's that are consistent with the history of theUE's DCI formats, the PDCCH detection is considered to likely be a falsealarm.

PDCCH RNTI occurrences: According to this approach, embodiments detectfalse alarms by considering how many times an RNTI appears as a validRNTI for PDCCH detections. Typically, most active RNTI's will recurfrequently, because most data transmissions typically require sendingmore than one packet in a short time span. In some of these embodiments,an RNTI is only added to the list of active RNTIs after it is found tobe a valid RNTI in a plurality of PDCCH detections.

RNTI allocation strategies: According to this approach, the allocationstrategies used by the BS to assign the RNTI's to the UE's is eitherknown or determined. These allocation strategies can then be used todetermine if an RNTI is valid. For example, if the BS is allocatingRNTIs to users sequentially, and if an RNTI is identified that is faroutside of the sequence of known active RNTI's, it can be identified asa false alarm.

RRC content: According to this approach, embodiments detect false alarmsby considering information included in RRC messages. For example,RRC_Connection_Release is used to free the RNTI of a user and transitionthe user to the idle mode. Accordingly, if an RRC_Connection_Release isdetected, then the corresponding, formerly active RNTI can be removedfrom the list of active RNTI's.

It can sometimes happen that none of the techniques described above issufficient by itself to compile and maintain an accurate list of activeRNTI's, and hence reduce the PDCCH false alarm rate to an acceptablelevel. This can occur for many reasons, such as:

-   -   Information Sharing is unavailable, unreliable or too slow    -   Acquisition Monitoring is unreliable because of SINR issues, or        because the complete acquisition handshake cannot be observed        due to its inclusion of both uplink and downlink messages    -   It is not known when an active UE transitions to the IDLE state    -   Pattern Detection is unreliable, and may not be sophisticated        enough by itself to determine the RNTIs

In such cases, embodiments combine several of the techniques describedabove. For example, if information sharing is unavailable, acquisitionmonitoring is unreliable, and transitioning of a UE to the IDLE statecannot be detected, then some embodiments use pattern detection toenhance acquisition monitoring. In some of these embodiments,acquisition monitoring is used to form a list of active RNTI's, but thelist is assumed not to be exhaustive. Pattern detection is then used tosearch for patterns that can be used to determine if other RNTI's shouldbe added to the list of active RNTI's. The detected patterns can includethe number of detections of a valid RNTI, the elimination of false PDCCHdetections by recognizing erroneous data within the PDCCH detections,and verification of RNTI's by monitoring the Physical Downlink SharedChannel data when available. In certain of these embodiments, an activeRNTI is assumed to have become inactive if it is not found to be a validRNTI for a PDCCH detections during a specified time period.

Embodiments further include at least one network restriction, wherebyalgorithms that control the base station cause parameters to be assignedin a way that makes it easier to determine false alarms. In someembodiments, the network restriction requires that the RNTI's beallocated in a certain pattern, such as incrementally increasing from aknown starting number. For example, if it is known that a base stationis required to allocate RNTI's sequentially, starting from 1000, and ifthere are three active UE's in the cell to which the RNTI's 1000, 1001,and 1002 have been assigned, and if the PDCCH sniffer extracts PDCCHdetections having valid RNTI's of 1002, 10630 and 57038, then it can bereasonably assumed that only the PDCCH detection having 1002 as itsvalid RNTI is correct, while the other two detections are false alarms.In certain embodiments, the base station is required to reassign an RNTIreleased by a UE that has returned to idle mode to the next user thattransitions to the RRC_CONNECTED state. For the example given above,when the UE to which RNTI 1001 has been assigned returns to the RRC_IDLEstate, then the next UE that transitions to the RRC_CONNECTED state willbe assigned RNTI 1001.

Another example of a network restriction that can make it easier todetermine false alarms is a restriction that limits the schedulingoptions that may be included within a PDCCH message, where a schedulingoption is anything that can occur within the PDCCH message. For example,certain modulation and coding options can be prohibited, or frequencyhopping may not be allowed.

FIG. 5 is a perspective view of a PDCCH sniffer embodiment 500. Thesniffer 500 includes a receiver 502 having a PDCCH detection antenna504, and a control unit 506 that causes the sniffer to implement atleast some of the approaches described above.

The controller 506 is an instruction execution machine, apparatus, ordevice and may comprise one or more of a microprocessor, a digitalsignal processor, a graphics processing unit, an application specificintegrated circuit (ASIC), a field programmable gate array (FPGA), andthe like. The controller 506 may be configured to execute programinstructions stored in a memory and/or data storage (both not shown).The memory may include read only memory (ROM) and random access memory(RAM). The data storage may include a flash memory data storage devicefor reading from and writing to flash memory, a hard disk drive forreading from and writing to a hard disk, a magnetic disk drive forreading from or writing to a removable magnetic disk, and/or an opticaldisk drive for reading from or writing to a removable optical disk suchas a CD ROM, DVD or other optical media. The drives and their associatedcomputer-readable media provide nonvolatile storage of computer readableinstructions, data structures, program modules and other data.

It is noted that the methods described herein can be embodied inexecutable instructions stored in a computer readable medium for use byor in connection with an instruction execution machine, apparatus, ordevice, such as a computer-based or processor-containing machine,apparatus, or device. It will be appreciated by those skilled in the artthat for some embodiments, other types of computer readable media may beused which can store data that is accessible by a computer, such asmagnetic cassettes, flash memory cards, digital video disks, Bernoullicartridges, RAM, ROM, and the like may also be used in the exemplaryoperating environment. As used here, a “computer-readable medium” caninclude one or more of any suitable media for storing the executableinstructions of a computer program in one or more of an electronic,magnetic, optical, and electromagnetic format, such that the instructionexecution machine, system, apparatus, or device can read (or fetch) theinstructions from the computer readable medium and execute theinstructions for carrying out the described methods. A non-exhaustivelist of conventional exemplary computer readable medium includes: aportable computer diskette; a RAM; a ROM; an erasable programmable readonly memory (EPROM or flash memory); optical storage devices, includinga portable compact disc (CD), a portable digital video disc (DVD), ahigh definition DVD (HD-DVD™), a BLU-RAY disc; and the like.

The controller 506 and receiver 502 preferably detect and analyzetransmissions from a BS 102 that operates in a networked environmentusing logical connections to one or more remote nodes (not shown). Theremote node may be another BS, a UE, a computer, a server, a router, apeer device or other common network node. The base station may interfacewith a wireless network and/or a wired network. For example, wirelesscommunications networks can include, but are not limited to, CodeDivision Multiple Access (CDMA), Time Division Multiple Access (TDMA),Frequency Division Multiple Access (FDMA), Orthogonal Frequency DivisionMultiple Access (OFDMA), and Single-Carrier Frequency Division MultipleAccess (SC-FDMA). A CDMA network may implement a radio technology suchas Universal Terrestrial Radio Access (UTRA), TelecommunicationsIndustry Association's (TIA's) CDMA2000®, and the like. The UTRAtechnology includes Wideband CDMA (WCDMA), and other variants of CDMA.The CDMA2000® technology includes the IS-2000, IS-95, and IS-856standards from The Electronics Industry Alliance (EIA), and TIA. A TDMAnetwork may implement a radio technology such as Global System forMobile Communications (GSM). An OFDMA network may implement a radiotechnology such as Evolved UTRA (E-UTRA), Ultra Mobile Broadband (UMB),IEEE 802.11 (Wi-Fi), IEEE 802.16 (WiMAX), IEEE 802.20, Flash-OFDMA, andthe like. The UTRA and E-UTRA technologies are part of Universal MobileTelecommunication System (UMTS). 3GPP Long Term Evolution (LTE) andLTE-Advance (LTE-A) are newer releases of the UMTS that use E-UTRA.UTRA, E-UTRA, UMTS, LTE, LTE-A, and GAM are described in documents froman organization called the “3rd Generation Partnership Project” (3GPP).CDMA2000® and UMB are described in documents from an organization calledthe “3rd Generation Partnership Project 2” (3GPP2). The techniquesdescribed herein may be used for the wireless networks and radio accesstechnologies mentioned above, as well as other wireless networks andradio access technologies. Other examples of wireless networks include,for example, a BLUETOOTH network, a wireless personal area network, anda wireless 802.11 local area network (LAN).

Examples of wired networks include, for example, a LAN, a fiber opticnetwork, a wired personal area network, a telephony network, and/or awide area network (WAN). Such networking environments are commonplace inintranets, the Internet, offices, enterprise-wide computer networks andthe like. In some embodiments, communication interface 112 may includelogic configured to support direct memory access (DMA) transfers betweenmemory 104 and other devices.

It should be understood that the arrangement illustrated in FIG. 5 isbut one possible implementation, and that other arrangements arepossible. It should also be understood that the various systemcomponents (and means) defined by the claims, described above, andillustrated in the various block diagrams represent logical componentsthat are configured to perform the functionality described herein. Forexample, one or more of these system components (and means) can berealized, in whole or in part, by at least some of the componentsillustrated in the arrangement of hardware device 500. In addition,while at least one of these components are implemented at leastpartially as an electronic hardware component, and therefore constitutesa machine, the other components may be implemented in software,hardware, or a combination of software and hardware. More particularly,at least one component defined by the claims is implemented at leastpartially as an electronic hardware component, such as an instructionexecution machine (e.g., a processor-based or processor-containingmachine) and/or as specialized circuits or circuitry (e.g., discretelogic gates interconnected to perform a specialized function), such asthose illustrated in FIG. 5. Other components may be implemented insoftware, hardware, or a combination of software and hardware. Moreover,some or all of these other components may be combined, some may beomitted altogether, and additional components can be added while stillachieving the functionality described herein. Thus, the subject matterdescribed herein can be embodied in many different variations, and allsuch variations are contemplated to be within the scope of what isclaimed.

In the description above, the subject matter is described with referenceto acts and symbolic representations of operations that are performed byone or more devices, unless indicated otherwise. As such, it will beunderstood that such acts and operations, which are at times referred toas being computer-executed, include the manipulation by the processingunit of data in a structured form. This manipulation transforms the dataor maintains it at locations in the memory system of the computer, whichreconfigures or otherwise alters the operation of the device in a mannerwell understood by those skilled in the art. The data structures wheredata is maintained are physical locations of the memory that haveparticular properties defined by the format of the data. However, whilethe subject matter is being described in the foregoing context, it isnot meant to be limiting as those of skill in the art will appreciatethat various of the acts and operation described hereinafter may also beimplemented in hardware.

To facilitate an understanding of the subject matter disclosed, manyaspects are described in terms of sequences of actions. At least one ofthese aspects defined by the claims is performed by an electronichardware component. For example, it will be recognized that the variousactions can be performed by specialized circuits or circuitry, byprogram instructions being executed by one or more processors, or by acombination of both. The description herein of any sequence of actionsis not intended to imply that the specific order described forperforming that sequence must be followed. All methods described hereincan be performed in any suitable order unless otherwise indicated hereinor otherwise clearly contradicted by context.

The use of the terms “a” and “an” and “the” and similar referents in thecontext of describing the subject matter (particularly in the context ofthe following claims) are to be construed to cover both the singular andthe plural, unless otherwise indicated herein or clearly contradicted bycontext. Recitation of ranges of values herein are merely intended toserve as a shorthand method of referring individually to each separatevalue falling within the range, unless otherwise indicated herein, andeach separate value is incorporated into the specification as if it wereindividually recited herein. Furthermore, the foregoing description isfor the purpose of illustration only, and not for the purpose oflimitation, as the scope of protection sought is defined by the claimsas set forth hereinafter together with any equivalents thereof entitledto. The use of any and all examples, or exemplary language (e.g., “suchas”) provided herein, is intended merely to better illustrate thesubject matter and does not pose a limitation on the scope of thesubject matter unless otherwise claimed. The use of the term “based on”and other like phrases indicating a condition for bringing about aresult, both in the claims and in the written description, is notintended to foreclose any other conditions that bring about that result.No language in the specification should be construed as indicating anynon-claimed element as essential to the practice of the invention asclaimed.

Preferred embodiments are described herein, including the best modeknown to the inventor for carrying out the claimed subject matter. Oneof ordinary skill in the art should appreciate after learning theteachings related to the claimed subject matter contained in theforegoing description that variations of those preferred embodiments maybecome apparent to those of ordinary skill in the art upon reading theforegoing description. The inventor intends that the claimed subjectmatter may be practiced otherwise than as specifically described herein.Accordingly, this claimed subject matter includes all modifications andequivalents of the subject matter recited in the claims appended heretoas permitted by applicable law. Moreover, any combination of theabove-described elements in all possible variations thereof isencompassed unless otherwise indicated herein or otherwise clearlycontradicted by context.

We claim:
 1. A method of determining scheduling information of a basestation in a network operating according to the Long Term Evolution(“LTE”) standard, the method comprising: monitoring transmissions on thePhysical Downlink Control CHannel (“PDCCH”) of the wireless basestation; maintaining a list of active Radio Network TemporaryIdentifiers (“RNTI's”) assigned by the wireless base station to userequipment; extracting PDCCH detections from the monitored transmissions;applying at least one false alarm reduction strategy to eliminateinvalid PDCCH detections from the extracted PDCCH detections, said falsealarm reduction strategy including determining an RNTI that is valid foran extracted PDCCH detection, and determining if the valid RNTI isincluded in the list of active RNTI's; and determining schedulinginformation of the wireless base station from the extracted PDCCHdetections; wherein the false alarm reduction strategy further includescomparing PDCCH detections with each other, and determining that a PDCCHdetection is invalid if it is inconsistent with other PDCCH detections;and wherein a PDCCH detection is determined to be invalid if it includesan apparent parameter change that is unlikely to be valid, the apparentparameter change being at least one of an apparent change of amodulation scheme that is unlikely to be valid; an apparent change of acoding scheme that is unlikely to be valid; and an apparent change inDCI format that is unlikely to be valid.
 2. The method of claim 1,wherein maintaining a list of active RNTI's includes obtaininginformation regarding active RNTI's from a secondary source.
 3. Themethod of claim 2, wherein the secondary source is the wireless basestation, an adjacent cell, a controller in the network, or a node in thenetwork that is distinct from the wireless base station.
 4. The methodof claim 1, wherein maintaining a list of active RNTI's includesmonitoring acquisition messages exchanged between the wireless basestation and the user equipment that assign RNTI's to user equipment andcontrol transitioning of the user equipment from an idle state to anactive state.
 5. The method of claim 4, wherein only downlinkacquisition messages are monitored, or only uplink acquisition messagesare monitored.
 6. The method of claim 1, further comprising: monitoringthe Physical Downlink Shared CHannel (“PDSCH”) of the wireless basestation; using information derived from the PDSCH to verify if a PDCCHdetection is a valid PDCCH detection; and if the PDCCH detection is avalid PDCCH detection, adding the RNTI that is valid for the PDCCHdetection to the list of active RNTI's.
 7. The method of claim 6,further comprising obtaining decoding metrics from at least one PDSCHpacket detected on the PDSCH, and using the decoding metrics todetermine if a corresponding PDCCH detection is a valid PDCCH detection.8. The method of claim 6, further comprising identifying which resourceblocks are active for the PDSCH messages, and determining at least oneof individual PDCCH detections and combinations of PDCCH detections thatare valid for the resource blocks that are determined to be active. 9.The method of claim 1, wherein the false alarm reduction strategyfurther includes discarding extracted PDCCH detections that containinformation which is inconsistent with at least one known PDCCHrequirement.
 10. The method of claim 9, wherein the at least one knownPDCCH requirement includes at least one of: a restriction on allowedDownlink Control Information formats; a restriction on allowedmodulation options a restriction on allowed coding options; arestriction on frequency hopping; and a restriction on allowablecombinations of download control information formats and transmissionmodes.
 11. The method of claim 1, wherein maintaining a list of activeRNTI's includes discarding a selected RNTI from the list of activeRNTI's if, during a specified time interval, no PDCCH detections areextracted for which the selected RNTI is the valid RNTI.
 12. The methodof claim 1, wherein the at least one false alarm reduction strategyfurther includes: determining a pattern of RNTI assignment by thewireless base station; and determining if the RNTI that is valid for theextracted PDCCH detection is consistent with the pattern of RNTIassignment.
 13. The method of claim 1, wherein maintaining a list ofactive RNTI's includes monitoring RRC messages to determine changes instatus of active RNTI's.
 14. The method of claim 1, further comprisingimposing at least one restriction on operating rules of the wirelessbase station that provides at least one criterion for discriminatingbetween valid PDCCH detections and invalid PDCCH detections.
 15. Asystem comprising: a sniffing device configured for receiving PDCCHtransmissions from a wireless base station in a network operatingaccording to the Long Term Evolution (“LTE”) standard; and a controllercoupled to the sniffing device, the controller being configured to:monitor transmissions on the Physical Downlink Control CHannel (“PDCCH”)of the wireless base station; maintain a list of active Radio NetworkTemporary Identifiers (“RNTI's”) assigned by the wireless base stationto user equipment; extract PDCCH detections from the monitoredtransmissions; apply at least one false alarm reduction strategy toeliminate invalid PDCCH detections from the extracted PDCCH detections,said false alarm reduction strategy including determining an RNTI thatis valid for an extracted PDCCH detection, and determining if the validRNTI is included in the list of active RNTI's; and determine schedulinginformation of the wireless base station from the extracted PDCCHdetections; wherein the false alarm reduction strategy further includescomparing PDCCH detections with each other, and determining that a PDCCHdetection is invalid if it is inconsistent with other PDCCH detections;and wherein a PDCCH detection is determined to be invalid if it includesan apparent parameter change that is unlikely to be valid, the apparentparameter change being at least one of an apparent change of amodulation scheme that is unlikely to be valid; an apparent change of acoding scheme that is unlikely to be valid; and an apparent change inDCI format that is unlikely to be valid.
 16. The system of claim 15,wherein maintaining a list of active RNTI's includes obtaininginformation regarding active RNTI's from a secondary source.
 17. Thesystem of claim 16, wherein the secondary source is the wireless basestation, an adjacent cell, a controller in the network, or a node in thenetwork that is distinct from the wireless base station.
 18. The systemof claim 15, wherein maintaining a list of active RNTI's includesmonitoring acquisition messages exchanged between the wireless basestation and the user equipment that assign RNTI's to user equipment andcontrol transitioning of the user equipment from an idle state to anactive state.
 19. The system of claim 18, wherein the controller isconfigure to monitor only downlink acquisition messages or only uplinkacquisition messages.
 20. The system of claim 15, wherein the controlleris further configured to: monitor the Physical Downlink Shared CHannel(“PDSCH”) of the wireless base station; use information derived from thePDSCH to verify if a PDCCH detection is a valid PDCCH detection; and ifthe PDCCH detection is a valid PDCCH detection, add the RNTI that isvalid for the PDCCH detection to the list of active RNTI's.
 21. Thesystem of claim 20, wherein the controller is further configured toobtain decoding metrics from at least one PDSCH packet detected on thePDSCH, and use the decoding metrics to determine if a correspondingPDCCH detection is a valid PDCCH detection.
 22. The system of claim 20,wherein the controller is further configured to identify which resourceblocks are active for the PDSCH messages, and determine at least one ofindividual PDCCH detections and combinations of PDCCH detections thatare valid for the resource blocks that are determined to be active. 23.The system of claim 15, wherein the false alarm reduction strategyfurther includes discarding extracted PDCCH detections that containinformation which is inconsistent with at least one known PDCCHrequirement.
 24. The system of claim 23, wherein the at least one knownPDCCH requirement includes at least one of: a restriction on allowedDownlink Control Information formats; a restriction on allowedmodulation options a restriction on allowed coding options; arestriction on frequency hopping; and a restriction on allowablecombinations of download control information formats and transmissionmodes.
 25. The system of claim 15, wherein maintaining a list of activeRNTI's includes discarding a selected RNTI from the list of activeRNTI's if, during a specified time interval, no PDCCH detections areextracted for which the selected RNTI is the valid RNTI.
 26. The systemof claim 15, wherein the at least one false alarm reduction strategyfurther includes: determining a pattern of RNTI assignment by thewireless base station; and determining if the RNTI that is valid for theextracted PDCCH detection is consistent with the pattern of RNTIassignment.
 27. The system of claim 15, wherein maintaining a list ofactive RNTI's includes monitoring RRC messages to determine changes instatus of active RNTI's.
 28. The system of claim 15, wherein thecontroller is further configured to impose at least one restriction onoperating rules of the wireless base station that provides at least onecriterion for discriminating between valid PDCCH detections and invalidPDCCH detections.
 29. A non-transitory computer readable medium storinga computer program, executable by a machine, for operating a sniffingdevice configured for receiving PDCCH transmissions from a wireless basestation in a network operating according to the Long Term Evolution(“LTE”) standard, the computer program comprising executableinstructions for: monitoring transmissions on the Physical DownlinkControl CHannel (“PDCCH”) of the wireless base station; maintaining alist of active Radio Network Temporary Identifiers (“RNTI's”) assignedby the wireless base station to user equipment; extracting PDCCHdetections from the monitored transmissions; applying at least one falsealarm reduction strategy to eliminate invalid PDCCH detections from theextracted PDCCH detections, said false alarm reduction strategyincluding determining an RNTI that is valid for an extracted PDCCHdetection, and determining if the valid RNTI is included in the list ofactive RNTI's; and determining scheduling information of the wirelessbase station from the extracted PDCCH detections; wherein the falsealarm reduction strategy further includes comparing PDCCH detectionswith each other, and determining that a PDCCH detection is invalid if itis inconsistent with other PDCCH detections; and wherein a PDCCHdetection is determined to be invalid if it includes an apparentparameter change that is unlikely to be valid, the apparent parameterchange being at least one of an apparent change of a modulation schemethat is unlikely to be valid; an apparent change of a coding scheme thatis unlikely to be valid; and an apparent change in DCI format that isunlikely to be valid.